Workflow Global Variables

# context

# log

# wfcontext

# handler

# step

# approval

# item

# trace

==================================================================================================================================

WorkflowEngine: It controls the Workflow from the start step to the end step i.e., It controls the starting, running & termination of a workflow.

Approval

 Approval steps don't have the below actions:

• can't call methods
• scripts
• workflow

Different ways to initialize a variable in workflow.

action='call:verifyCondition'

intializer='string:prasad'

script:identity.getEmail()

value='ref:identity'

rule:Mighty Rule library

Workflow Libraries

  What is a workflow library?

• Workflow Libraries are sets of compiled Java methods accessible to workflows.

What are the workflow default libraries?

• Identity
• Role
• PolicyViolation
• LCM libraries

IdentityLibrary: This is used to

• getManager()
• activate, de-activate role assignment
• Refresh Identities
• Compiling Provisioning plan
• Build, Assimilate Provisioning Forms
• Auditing etc.,

IdentityRequestLibrary: This is used to

• Create Identity Request, update Identity Request state
• Refresh Identity Request afterApproval and Provisioning etc.,

ApprovalLibrary: This is used to

• Get Object(Approval) owner and name
• Get NewObject(Approval) owner and name
• Checks whether it's a self-Approval or not etc.,

Policy Violation Library: This is used to

• Get the remediateViolation: Remediate SOD violations by removing roles named in the remediations argument.
• Delete the current approval object associated with this workflow.

Role Library: This is used to invoke the methods

• Enable the role
• Disable the role
• buildOwnerApproval

LCM Library: All the methods are moved to a handler

• audit
• addLaunchMessage
• Commit

Sailpoint provided the following rule libraries:

Workflow Library: This is mostly used to get the properties of an identity

which are like displayName, email, managerName, managerEmail, and getting

value of a system configuration property.

LCM Workflow Library: This is used for assimilating WorkItem

ApprovalSet, performs auditing for actions like forward, comment on workItem

and for filtering ApprovalSet.

Approval Library: This is used for getting a list of Approval owners, Role

owner, manager from a provisioning plan, etc.,

How to launch workflow using java (API's)?

# Map object to pass as variables to workflow

HashMap launchArgsMap = new HashMap();

launchArgsMap.put(“identityName”,”Prasad”);

launchArgsMap.put(“managerName”,”Santosh”);

# Getting workflow object

Workflow workflow = (Workflow)context.getObjectByName(Workflow.class,"workflowName"); 

# Creating workflowLaunch object

WorkflowLaunch wfLaunch = new WorkflowLaunch(); 

wfLaunch.setWorkflowName(workflow.getName()); 

wfLaunch.setWorkflowRef(workflow.getName()); 

wfLaunch.setCaseName("LCM Provisioning"); 

wfLaunch.setVariables(launchArgsMap); //pass values to workflow 

# Create Workflower and launch workflow from WorkflowLaunch

Workflower workflower = new Workflower(context); 

WorkflowLaunch launch = workflower.launch(wfLaunch); 

Note: 

A class for managing the lifecycle and side effects of Workflows and WorkItems.

For developers outside of SailPoint, the primary methods that should be used are the ones for launching workflows. 

The methods for managing the lifecycle of WorkItems are normally only used by the UI, though it is permissible to finish WorkItems in custom code.

# print workflowCase ID

String workFlowId = launch.getWorkflowCase().getId(); 

System.out.println("workFlowId: "+workFlowId); 

How to schedule the workflow?

Request request = new Request(); 

RequestDefinition requestdefinition = context.getObject(RequestDefinition.class, "Workflow Request"); 

request.setDefinition(requestdefinition); 

request.setEventDate( new Date( launchTime ) ); 

request.setOwner(id); 

request.setName(caseName); 

request.setAttributes(requestdefinition , reqArgs); 

//Request args is map to pass the values to workflow.

RequestManager.addRequest(context, request);

// Schedule the workflow via the request manager. 

# What is Request API?

A model to represent a request for a single target object. A list of these is found within a Plan object. 

Usually the target is a user account, but it could be a group or some other object managed by this connector.

Note: 

Model - Model represents an object or JAVA POJO carrying data.

# What is RequestDefinition API?

An object describing a background request.

# what is RequestManager API?

A class providing an API for managing the request processor and submitting asynchronous requests.

Note:  

The asynchronous process defines a process that is operated independently with other processes.

Workflow Variables

# name: Specifies the name of the variable

# initializer: Used to calculate the default value of the variable

# required: The business process will not launch if an initial value for this variable is not 

supplied

# editable: Specifies the variable that can be edited during business process execution

# input: If it is set to true, just we are explicitly saying to the workflow handler that we 

didn’t initialize this variable else the variable initialized by the user

# output: An output variable and the final value are copied into the task results

# trigger : The IdentityTrigger

# event : The IdentityChangeEvent.  It can be used to build the provisioning plan but does not need to be persisted with the case, so marked as transient.

# identityName : The name of the identity

# identityDisplayName : The displayName of the identity being updated

# plan : The provisioning plan, which is built by a service method

# optimisticProvisioning : Set to true to enable optimistic provisioning.  This will cause changes to the entitlements compiled from role assignments to be applied immediately to the identity cube rather than waiting for the next refresh/reaggregation after the provisioning system completes the request.

# foregroundProvisioning : Normally provisioning is done in a step that uses the background option to force the workflow to be suspended and resumed in a background task thread. This prevents the browser session from hanging since provision can sometimes take a long time. For demos and testing it can be better to do this in the foreground so that provisioning will have been performed when control is returned to the user. This prevents having to run the Perform Maintenance task to see the results of the request.

# fallbackApprover : A String that specifies the name of the Identity that will be assigned any approvals where the owner of the approver cannot be resolved. For example if the scheme is owner and the application does not specify an owner.

# source : String version of sailpoint.object.Source to indicate where the request originated.  Defaults to LCM

# trace : Used for debugging this workflow and when set to true trace will be sent to stdout.

# project : ProvisioningProject which is just a compiled version of the ProvisioningPlan.

# identityRequestId : The sequence id of the Identity request object which is stored in the name field of the identity request.

# cart : This variable includes all ApprovalItems that are part of the request process and is updated during the AfterScript of the approval process by assimilating the decisions and comments from the Approvals copy of the ApprovalItem.

# workItemPriority : The String version of a WorkItem.Priority. This variable is used to set the priority on all of the workitems generated as part of this workflow and also set on the IdentityRequest object.

# flow : 

# notifyAdmins : If this gets set to true we need to notify a workgroup of IdentityIQ admins that the person has left. 

# directReports : List of identity names of people who report directly to the leaver.

# appOwnerList : List of names of applications for which the leaver is the owner.

# appSystemAdminList : List of names of applications for which the leaver is the System Administrator.

# appSystemAdminList : List of names of applications for which the leaver is the System Administrator

# workgroupMembershipList : List of workgroups of which the leaver is a member.

# appDAList : List of names of applications for which the leaver is a delegated authority.

# roleDAList : List of roles for which the leaver is a delegated authority.

# entitlementDAList : List of entitlements (including the attribute name, attribute value, and application) for which the leaver is a delegated authority.

# appContactPersonList : List of names of applications for which the leaver is the Contact Person.

# roleOwnerList : List of names of roles for which the leaver is the owner.

# appRemediatorList : List of names of applications for which the leaver is a remediator.

Workflows

Reference: 

Lifecycle Manager Workflows - Compass (sailpoint.com)

What is workflow (Business process)?

• A sequence of operations or steps that are launched to perform work.
• It defines the steps involved to perform a certain task.

What is workflowcase? (Workflow: workflowcase - Class : Object)

• Workflow is in progress. It is an instance of workflow for a particular task

What is workflowcontext?

• It is available in all workflows
• It contains all variables, step arguments, approval, workflow definition, library, and workflowcase.
• It contains everything present or used in that workflow 

What is workflowHandler?

• WorkflowHandler contains all workflow variables, step arguments, current step or approval, workflow definition, libraries, and workflowCase.

What is TaskResult?

• It is a status of a workflow.

What is the provisioning plan in the workflow?

• In the workflow, the provisioning plan contains a list of requested changes to an identity.
• Identity or IdentityName variable will be present in most of the workflows.
• A provisioning plan is created for each identity.

How to Trigger a Workflow?

The following ways to trigger a workflow     :

• Life Cycle Manager (LCM):    Access request, changing entitlement, roles, etc.,
• Life Cycle Event:    Create an identity and various life events like a joiner, mover, termination, rehire
• Policy Violation:    A policy violation
• Identity Attribute Change
• Editing a role, changing a password, etc.,

What are the types of workflows available in SailPoint?

The following are a few important Workflow types :

• Policy Violation
• Managed Attribute
• LCM Provisioning
• Identity Correlate
• Identity Refresh
• Identity Update
• Identity LifeCycle
• SubProcess

What are the major components of workflow?

# Workflow name and type

# Description (optional)

# Libraries (optional)

# Variables

• Initialized
• Calculated value (in rule/script)

# Steps with proper transition and conditions

• start step
• more steps
• can call other subprocesses with proper arguments
• can use forms/approvals / rules
• stop step